FortiOS v5.2.4 is out(Unstable GUI, Bad SSLVPN)....

[storaid]

a little disappointed..

no enhancements..

it's just a bugs fixed release....

[size="5"]definitely 1 of terrible f/w for FOS...[/size]

UNSTABLE GUI

[size="6"]ANNOYING SSL VPN problem..............[/size]

[size="3"]fortinet, I think you must quickly push out next fixed release or give some explains.........[/size]

201508020844, CSB-150730-1-Partial-Config-Loss

FortiGate models listed below may lose configuration pertaining to IPsec interface, virtual access point interface, loopback interface, or virtual-switch interface after a reboot when the FortiGate is deployed with FortiOS 5.2.4 with build number 0688 and time 150722.

FGT20C3X12000161 # get sys stat

Version: FortiGate-20C v5.2.4,build0688,150722 (GA)

Potentially Affected Products:

FortiGate: FG-20C, FG-20C-ADSL, FG-30D, FG-30D-PoE, FG-40C

FortiWiFi: FW-20C, FW-20C-ADSL, FW-30D, FW-30D-PoE, FW-40C

Resolution:

FortiOS 5.2.4 software images for the models above have been rebuilt and re-posted on the customer support web site with build number 0688 and time 150730.

[seadave · Accepted solution]

Why does this keep happening?  Fortinet makes such great hardware, but they have seriously burned some of us with bad firmware releases.  I'm a constant Fortinet advocate, but this kind of crap demonstrates a lack of QC and concern for the customer environment.  These type of issues should definitely be exposed by a good QC system and if the firmware has the potential to wipe a config, for godness sakes it should not be released.  Those of us who are long time Fortinet customers have learned to be wary of new releases and to always reboot the appliance, take a back up, and wait for others to expose the bugs, but it doesn't need to be that way with the right internal controls at Fortinet.  Pick up the slack guys.  You make a great product but you are tripping over your own feet when you release builds like this.

[emnoc]

BTW a  FGT90D we pushed upgrades earlier, now started  having L2TP/ipsec issues, and xauth failures. Users where failing  but the same users  credentials ( local ) copied onto a FGT100D running 5.2.3 had no issues. I think it has todo with the  password type, but still investigating. We found out deleting the user password and copy the text exactly back in, allows for the user to authenticate. Anybody seem issues with config user local and accounts?

I would open a ticket with support but don't have the time and have like 2 other TAC cases for items related to 5.0.10 pending.

[SecurityPlus]

If Fortinet discovers an error in a release (i.e. 5.2.4) will they patch the 5.2.4 release or do they wait till the next release (i.e. 5.2.5) to apply the patch?

Are some finding the 5.2.4 release to be problem free or are the problems more widespread?

Thanks!

[Zulhardy]

There are quite a number of bugs in 5.2.4. Do not use it. Use 5.2.3 instead.

SecurityPlus wrote:
If Fortinet discovers an error in a release (i.e. 5.2.4) will they patch the 5.2.4 release or do they wait till the next release (i.e. 5.2.5) to apply the patch?   Are some finding the 5.2.4 release to be problem free or are the problems more widespread?   Thanks!

[Zulhardy]

There are quite a number of bugs in 5.2.4. Do not use it. Use 5.2.3 instead.

SecurityPlus wrote:
If Fortinet discovers an error in a release (i.e. 5.2.4) will they patch the 5.2.4 release or do they wait till the next release (i.e. 5.2.5) to apply the patch?   Are some finding the 5.2.4 release to be problem free or are the problems more widespread?   Thanks!

[Paul_S]

SecurityPlus wrote:

If Fortinet discovers an error in a release (i.e. 5.2.4) will they patch the 5.2.4 release or do they wait till the next release (i.e. 5.2.5) to apply the patch?

They generally wait for the next release to include the bug fixes, unless the bug is so significant they feel they cannot wait.

SecurityPlus wrote:

Are some finding the 5.2.4 release to be problem free or are the problems more widespread?

I am wondering this too. If 5.2.4 was a total flop, then either Fortinet would re-release or the forum thread would have 2000 comments, right?!  Maybe only a few dozen people have been brave enough to try it?

[emnoc]

Maybe only a few dozen people have been brave enough to try it?

or foolish enough

Typically I wait at least 2 months b4 loading my gear on the wagon, that way you let others cross the water b4 you . This way if they have problems & drown, you can stay on the banks and be safe.

Never run the latetest in a production env until you had time to evaluate and demo the code.

[simonpt]

emnoc wrote:

or foolish enough

Typically I wait at least 2 months b4 loading my gear on the wagon, that way you let others cross the water b4 you . This way if they have problems & drown, you can stay on the banks and be safe.

Never run the latetest in a production env until you had time to evaluate and demo the code.

I agree.  But then you'll still be evaluating v5.2.5 when your v5.0 production boxes go out of support in November.

Fortinet's aggressive software product life cycle policy, combined with their lack of decent QA on new releases, has more negative impact on their loyal customer base than I think they realise.

[kwilley]

simonpt wrote:

Fortinet's aggressive software product life cycle policy, combined with their lack of decent QA on new releases, has more negative impact on their loyal customer base than I think they realise.

+1

[ISOffice]

We also have upgraded to v5.2.4 (build 688) on our FG 100D cluster. Whilst not having experienced any major faults with it (other than the slightly annoying failure to display the right pane on occasion), the amount of posts here complaining about it does give me cause for concern and I'm thinking of rolling back to v5.2.3 (build 670).

Therefore I'm asking if the following is an acceptable way to downgrade to a previous version.

In the System Information widget, under Firmware Version, select Update.

Under Available Firmware, All Available, I can see several previous versions of FortiOS (image attached). I have the option to choose any of these versions, select Confirm Version Downgrade and click on Backup Config and Downgrade.

Is this a viable (and indeed advisable) way to go about downgrading our appliances? Apparently it may "result in the loss of some configuration". Can anyone be specific about what this may be?

Many thanks,

John P

[Paul_S]

ISOffice wrote:

We also have upgraded to v5.2.4 (build 688) on our FG 100D cluster. Whilst not having experienced any major faults with it (other than the slightly annoying failure to display the right pane on occasion), the amount of posts here complaining about it does give me cause for concern and I'm thinking of rolling back to v5.2.3 (build 670).

Therefore I'm asking if the following is an acceptable way to downgrade to a previous version.

In the System Information widget, under Firmware Version, select Update.

Under Available Firmware, All Available, I can see several previous versions of FortiOS (image attached). I have the option to choose any of these versions, select Confirm Version Downgrade and click on Backup Config and Downgrade.

Is this a viable (and indeed advisable) way to go about downgrading our appliances? Apparently it may "result in the loss of some configuration". Can anyone be specific about what this may be?

Many thanks,

John P

I would be on 5.2.4 if I thought it was stable. 5.2.3 has major bugs that affect me. If you got to 5.2.4 without major issues, I would consider staying on 5.2.4 either permanently or at least for a while. If everyone avoids 5.2.4 and does just submit support tickets, then 5.2.5 might not get much better than 5.2.4.

regarding downgrades, the process is fairly predictable. backup config, upload firmware, restore config. If you have a pre-upgrade config made on the older firmware version and you have not made many changes, then you can use that previous backup. If you read the downgrade section of most release notes it will mention how most of your config will be lost after a downgrade. don't freak out. This is normal. It will still keep enough config for the device to be reachable for admin login so that you can do the config restore.